⚠️ Security fixes

• Fix an open redirect during account creation. Exploitation requires initiating account creation with a maliciously crafted link, and then finalizing the signup process, after which the user would be redirected to an external page instead of staying on Indico (thanks @GauthierGitHub)

🎏 Internationalization

• New translation: Japanese

🎉 Improvements

• Allow specifying "prev" and "next" as the date param on the category overview page to show the previous or next period relative to the current date (#6537)
• Add caching and rate-limiting (configurable via LATEX_RATE_LIMIT, and only applied to unauthenticated users) for endpoints that trigger LaTeX PDF generation (#6526)
• Log changes to registration form settings in the event log (#6544, thanks @vtran99)
• Improve conference participant list, especially when participants from multiple registration forms are shown separately (#6440, #6489)
• Include information about attached files in JSON export of abstracts (#6556)
• Take session program codes into account when sorting parallel sessions with the same start time in meeting timetable (#6575)
• Enforce browser-side caching of event logos and custom stylesheets (#6555, #6559)
• Default to banner-style (full width) logos in newly created conference events (#6572, thanks @OmeGak)
• Add email placeholder for the picture associated with a registration (#6580, thanks @vtran99)
• Allow setting placeholders for text fields in receipt templates (#6587)
• Add a new receipt template for Certificates of Attendance (#6587)
• Show correct repetition details for bookings repeating every n weeks (#6592)
• Show context (event/contribution title etc.) in the title of the minutes editor (#6584, #6591)
• Streamline "get next editable" UI and only show editables that still unassigned (#6583)
• Add preview link for custom text snippets in registration notification emails (#6539, #6560, thanks @Moliholy, @unconventionaldotdev)
• Stop spoofing email sender addresses when using the SMTP_ALLOWED_SENDERS and SMTP_SENDER_FALLBACK config settings. Instead, the From address will be rewritten to the fallback whenever the requested address is not an allowed sender (#6231, thanks @SegiNyn)
• Allow alternative CSV delimiters everywhere when importing content from CSV files (#6607, thanks @Moliholy, @unconventionaldotdev)
• Improve readability of room booking room statistics card (#6616)
• Add option to use flat zip file structure when downloading registration attachments (#6536, #6608, thanks @Moliholy, @unconventionaldotdev)

🐛 Bugfixes

• Make picture field more resilient when uploading and resizing pictures close to the max upload file size (#6530, thanks @SegiNyn)
• Fix the order of the event classifications in edit mode (#6531, #6534)
• Fix an issue where scheduling a contribution on a day with an empty timetable would schedule it on the first day of the event instead (#6540, #6541)
• Fix error in unmerged participant list when the picture field is enabled and participant list columns have not been customized for that registration form (#6535)
• Fix breakage of the registration form dropdown field (and anything else using a custom element that uses ElementInternals) in older versions of Safari (#6549, thanks @foxbunny)
• Fix linebreak display in markdown code blocks in survey section descriptions (#6553)
• Include attached pictures when downloading registration attachments (#6564)
• Only allow marking unpaid registrations as paid (#6330, #6578)
• Do not allow mixing notification rules for invited abstracts with other rules (#6563, #6567)
• Use locale-aware price formatting in registration form fields (#6586)
• Handle badge designer items exceeding the canvas boundaries more gracefully (#6603, thanks @SegiNyn)

♿ Accessibility

• Improve country input accessibility (#6551, thanks @foxbunny)
• Reimplement Checkbox to make it programmatically focusable (#6528, thanks @foxbunny)
• Implement a RadioButton component to replace the SUI radio button in order to improve keyboard support (#6621, thanks @foxbunny)
• Improve keyboard accessibility of the timetable sessions field in registration form (#6639, thanks @foxbunny)

🔧 Internal Changes

• Make positioning logic from TipBase generic and reusable (#6577, #6588, thanks @foxbunny)
• Add additional signals related to videoconferences and their event links (#6475)
• Videoconference plugins now need to implement a delete_room method (#6475)
• Support translator comments when extracting translatable strings (#6620)
• renderAsFieldset option in the registration field registry can now be a function that returns a boolean (#6621, thanks @foxbunny)
• Allow overriding global theme settings for custom meeting themes (#6622)